CVE-2017-7514: red hat red hat satellite Cross-site Scripting

CVSS: 5.4v3.0MediumModified

AliasesSUSE-SU-2017:2964-1RHSA-2017:1558

Published 30-07-2018Last modified 05-08-2024

Vulnerability summary

CVE-2017-7514 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in red hat red hat satellite. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 49.7% of scored vulnerabilities.

Overall risk

22/100

0100

Low · default modelHow is this calculated?

CVSS score

5.4/10

010

Medium · v3.0 (NVD)

EPSS score

0.64%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

30-07-2018
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

A cross-site scripting (XSS) flaw was found in how the failed action entry is processed in Red Hat Satellite before version 5.8.0. A user able to specify a failed action could exploit this flaw to perform XSS attacks against other Satellite users.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.05.4v2.03.5

EPSS trend

Probability

0.64%

Chance of exploitation in the next 30 days

Percentile

50%

Versus all other CVEs

30-day change

0.00 pp

From 0.64% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.64%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Redhat179 products

satellite< 5.8.0
ace-editor< 0:1.1.3-3.el6sat
antlr< 0:2.7.7-7.ep5.el6
apache-commons-beanutils< 0:1.8.3-10.redhat_2.ep6.el6
apache-commons-cli< 0:1.2-7.5.redhat_2.ep6.el6.4

bootstrap< 0:3.0.0-4.el6sat
bootstrap-datepicker< 0:1.3.0-2.el6sat
c3p0< 0:0.9.1.2-2.ep5.el6
cdn-sync-mappings< 0:2.2-1.el6sat
cglib< 0:2.2-5.6.ep5.el6
cobbler< 0:2.0.7-66.el6sat
cobbler-loaders< 0:1.0.3-1.el6sat
concurrent< 0:1.3.4-10.1.5_jboss_update1.ep5.el6
cx_Oracle< 0:5.1.2-6.el6sat
cx_Oracle-debuginfo< 0:5.1.2-6.el6sat
dojo< 0:1.6.1-1.el6sat
dom4j< 0:1.6.1-11.1.ep5.el6
dwr< 0:3.0rc2-7.el6sat
font-awesome< 0:4.0.3-1.el6sat
glassfish-jsf< 0:1.2_13-3.1.4.ep5.el6
hibernate3< 1:3.3.2-1.3.GA_CP04.ep5.el6
jabberd< 0:2.2.8-23.el6sat
jabberd-debuginfo< 0:2.2.8-23.el6sat
jabberpy< 0:0.5-0.22.el6sat
jakarta-commons-chain< 0:1.2-2.2.2.ep5.el6
jakarta-commons-codec< 0:1.3-11.7.el6
jakarta-commons-codec-debuginfo< 0:1.3-11.7.el6
jakarta-commons-digester< 0:1.8.1-8.1.1.1.ep5.el6
jakarta-commons-el< 0:1.0-19.2.1.1.ep5.el6
jakarta-commons-fileupload< 1:1.1.1-7.4.ep5.el6
jakarta-commons-io< 0:1.4-4.ep5.el6
jakarta-commons-lang< 0:2.4-1.1.el6
jakarta-commons-logging< 0:1.1.1-1.ep5.el6
jakarta-commons-logging-jboss< 0:1.1-10.3_patch_02.1.ep5.el6
jakarta-commons-parent< 0:11-2.1.2.ep5.el6
jakarta-commons-validator< 0:1.3.1-7.5.2.ep5.el6
jakarta-oro< 0:2.0.8-6.6.el6
jakarta-oro-debuginfo< 0:2.0.8-6.6.el6
jakarta-taglibs-standard< 0:1.1.1-12.ep5.el6
java-1.8.0-ibm< 1:1.8.0.4.1-1jpp.1.el6_8
java-1.8.0-ibm-devel< 1:1.8.0.4.1-1jpp.1.el6_8
javassist< 0:3.12.0-6.SP1.ep5.el6
jboss-javaee< 0:5.0.1-2.9.ep5.el6
jboss-javaee-poms< 0:5.0.1-2.9.ep5.el6
jboss-transaction-1.0.1-api< 0:5.0.1-2.9.ep5.el6
jcommon< 0:1.0.16-1.2.2.ep5.el6
jdom< 0:1.1.1-1.el6
jfreechart< 0:1.0.13-2.3.2.1.1.ep5.el6
jpam< 0:0.4-28.el6sat
jpam-debuginfo< 0:0.4-28.el6sat
jquery-timepicker< 0:1.3.3-1.el6sat
jquery-ui< 0:1.10.4.custom-2.el6sat
libgsasl< 0:1.4.0-5.el6sat
libgsasl-debuginfo< 0:1.4.0-5.el6sat
libntlm< 0:1.0-4.el6sat
libntlm-debuginfo< 0:1.0-4.el6sat
momentjs< 0:2.6.0-2.2.el6sat
nutch< 0:1.0-0.16.20081201040121nightly.el6sat
objectweb-asm< 0:3.2-2.1.el6
oracle-config< 0:1.1-7.el6sat
oracle-instantclient< 0:10.2.0-47.el6sat
oracle-instantclient-basic< 0:10.2.0-47.el6sat
oracle-instantclient-selinux< 0:10.2.0.19-6.el6sat
oracle-instantclient-sqlplus< 0:10.2.0-47.el6sat
oracle-instantclient-sqlplus-selinux< 0:10.2.0.19-6.el6sat
oracle-nofcontext-selinux< 0:0.1.23.36-1.el6sat
oracle-selinux< 0:0.1.23.36-1.el6sat
osa-common< 0:5.11.63-11.el6sat
osa-dispatcher< 0:5.11.63-11.el6sat
osa-dispatcher-selinux< 0:5.11.63-11.el6sat
osad< 0:5.11.63-11.el6sat
oscache< 0:2.2-3.ep5.el6
patternfly1< 0:1.0.5-10.el6sat
perl-Class-Singleton< 0:1.4-6.el6
perl-DateTime< 1:0.5300-1.el6
perl-DateTime-debuginfo< 1:0.5300-1.el6
perl-DBD-Oracle< 0:1.62-3.el6sat
perl-DBD-Oracle-debuginfo< 0:1.62-3.el6sat
perl-Filesys-Df< 0:0.92-8.el6sat
perl-Filesys-Df-debuginfo< 0:0.92-8.el6sat
perl-Frontier-RPC-Client< 0:0.07b4p1-10.el6
perl-List-MoreUtils< 0:0.22-10.el6
perl-List-MoreUtils-debuginfo< 0:0.22-10.el6
perl-Mail-RFC822-Address< 0:0.3-12.el6sat
perl-Params-Validate< 0:0.92-3.el6
perl-Params-Validate-debuginfo< 0:0.92-3.el6
perl-Satcon< 0:2.5.0-2.el6sat
perl-Term-Completion< 0:1.00-9.el6sat.2
perl-TermReadKey< 0:2.30-13.el6
perl-TermReadKey-debuginfo< 0:2.30-13.el6
pwstrength-bootstrap< 0:1.0.2-4.el6sat
pyliblzma< 0:0.5.3-14.el6sat
pyliblzma-debuginfo< 0:0.5.3-14.el6sat
python-debian< 0:0.1.16-5.el6sat
python-gzipstream< 0:2.3.3-1.el6sat
quartz< 0:1.8.4-6.el6sat
quartz-oracle< 0:1.8.4-6.el6sat
redhat-access-plugin-sat5< 0:2.1.0-56.el6sat
redstone-xmlrpc< 0:1.1_20071120-16.el6sat
rh-postgresql95< 0:2.2-3.el6
rh-postgresql95-postgresql< 0:9.5.4-2.el6
rh-postgresql95-postgresql-contrib< 0:9.5.4-2.el6
rh-postgresql95-postgresql-debuginfo< 0:9.5.4-2.el6
rh-postgresql95-postgresql-libs< 0:9.5.4-2.el6
rh-postgresql95-postgresql-pltcl< 0:9.5.4-2.el6
rh-postgresql95-postgresql-server< 0:9.5.4-2.el6
rh-postgresql95-runtime< 0:2.2-3.el6
rhn-i18n-guides< 0:5.8.0.3-1.el6sat
rhn-i18n-release-notes< 0:5.8.0.2-1.el6sat
rhnpush< 0:5.5.89-20.el6sat
roboto< 0:1.3-1.el6sat
satellite-branding< 0:5.8.0.8-1.el6sat
satellite-doc-indexes< 0:5.8.0-1.el6sat
satellite-repo< 0:5.8.0.2-2.el6sat
satellite-schema< 0:5.8.0.31-1.el6sat
select2< 0:3.4.5-3.el6sat
select2-bootstrap-css< 0:1.3.0-5.el6sat
simple-core< 0:3.1.3-7.el6sat
sitemesh< 0:2.4.2-2.ep6.el6
spacecmd< 0:2.5.0-14.el6sat
spacewalk< 0:2.5.0-10.el6sat
spacewalk-admin< 0:2.5.0-3.el6sat
spacewalk-backend< 0:2.5.3-143.el6sat
spacewalk-backend-app< 0:2.5.3-143.el6sat
spacewalk-backend-applet< 0:2.5.3-143.el6sat
spacewalk-backend-cdn< 0:2.5.3-143.el6sat
spacewalk-backend-config-files< 0:2.5.3-143.el6sat
spacewalk-backend-config-files-common< 0:2.5.3-143.el6sat
spacewalk-backend-config-files-tool< 0:2.5.3-143.el6sat
spacewalk-backend-iss< 0:2.5.3-143.el6sat
spacewalk-backend-iss-export< 0:2.5.3-143.el6sat
spacewalk-backend-libs< 0:2.5.3-143.el6sat
spacewalk-backend-package-push-server< 0:2.5.3-143.el6sat
spacewalk-backend-server< 0:2.5.3-143.el6sat
spacewalk-backend-sql< 0:2.5.3-143.el6sat
spacewalk-backend-sql-oracle< 0:2.5.3-143.el6sat
spacewalk-backend-sql-postgresql< 0:2.5.3-143.el6sat
spacewalk-backend-tools< 0:2.5.3-143.el6sat
spacewalk-backend-xml-export-libs< 0:2.5.3-143.el6sat
spacewalk-backend-xmlrpc< 0:2.5.3-143.el6sat
spacewalk-base< 0:2.5.2-11.el6sat
spacewalk-base-minimal< 0:2.5.2-11.el6sat
spacewalk-base-minimal-config< 0:2.5.2-11.el6sat
spacewalk-certs-tools< 0:2.5.0-2.el6sat
spacewalk-common< 0:2.5.0-10.el6sat
spacewalk-config< 0:2.6.0-3.el6sat
spacewalk-dobby< 0:2.5.2-11.el6sat
spacewalk-html< 0:2.5.2-11.el6sat
spacewalk-java< 0:2.5.14-89.el6sat
spacewalk-java-config< 0:2.5.14-89.el6sat
spacewalk-java-lib< 0:2.5.14-89.el6sat
spacewalk-java-oracle< 0:2.5.14-89.el6sat
spacewalk-java-postgresql< 0:2.5.14-89.el6sat
spacewalk-oracle< 0:2.5.0-10.el6sat
spacewalk-postgresql< 0:2.5.0-10.el6sat
spacewalk-postgresql-server< 0:9.5-1.el6sat
spacewalk-reports< 0:2.5.0-6.el6sat
spacewalk-schema< 0:2.5.1-49.el6sat
spacewalk-search< 0:2.5.1-4.el6sat
spacewalk-selinux< 0:2.3.2-1.el6sat
spacewalk-setup< 0:2.5.1-22.el6sat
spacewalk-setup-jabberd< 0:2.3.2-1.el6sat
spacewalk-setup-postgresql< 0:2.5.0-27.el6sat
spacewalk-slf4j< 0:1.6.1-6.el6sat
spacewalk-ssl-cert-check< 1:2.4-1.el6sat
spacewalk-taskomatic< 0:2.5.14-89.el6sat
spacewalk-usix< 0:2.7.1-3.el6sat
spacewalk-utils< 0:2.5.1-23.el6sat
spacewalk-web< 0:2.5.2-11.el6sat
stringtree-json< 0:2.0.9-10.el6sat
struts< 0:1.3.10-6.ep5.el6
struts-core< 0:1.3.10-6.ep5.el6
struts-extras< 0:1.3.10-6.ep5.el6
struts-taglib< 0:1.3.10-6.ep5.el6
tanukiwrapper< 0:3.2.3-15.el6sat
tanukiwrapper-debuginfo< 0:3.2.3-15.el6sat
udns< 0:0.1-1.el6sat
udns-debuginfo< 0:0.1-1.el6sat
xalan-j2< 0:2.7.0-9.8.el6

Show all 179

Suse16 products

nutch&distro=SUSE Manager Server 3.0< 1.0-0.9.5.4
release-notes-susemanager&distro=SUSE Manager Server 3.0< 3.0.9-0.53.9.2
salt-netapi-client&distro=SUSE Manager Server 3.0< 0.13.0-16.6.4
spacecmd&distro=SUSE Manager Server 3.0< 2.5.5.9-16.9.4
spacewalk-backend&distro=SUSE Manager Server 3.0< 2.5.24.14-26.11.4

Show all 16

Red hat1 product

red hat satellite5.8.0

3 vendors · 196 products

References

50 links

access.redhat.com/errata/RHSA-2017:1558Vendor AdvisoryX Refsource REDHATAdvisory
bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7514X Refsource CONFIRMIssue TrackingVendor Advisory
www.suse.com/support/update/announcement/2017/suse-su-20172964-1/Advisory
bugzilla.suse.com/1019097REPORT
bugzilla.suse.com/1021432REPORT
bugzilla.suse.com/1032065REPORT
bugzilla.suse.com/1032122REPORT
bugzilla.suse.com/1038862REPORT
bugzilla.suse.com/1040420REPORT
bugzilla.suse.com/1041489REPORT

Show all 50 references

bugzilla.suse.com/1042265REPORT
bugzilla.suse.com/1043880REPORT
bugzilla.suse.com/1044719REPORT
bugzilla.suse.com/1045152REPORT
bugzilla.suse.com/1048294REPORT
bugzilla.suse.com/1048295REPORT
bugzilla.suse.com/1049139REPORT
bugzilla.suse.com/1053038REPORT
bugzilla.suse.com/1054044REPORT
bugzilla.suse.com/1054902REPORT
bugzilla.suse.com/1055292REPORT
bugzilla.suse.com/1055467REPORT
bugzilla.suse.com/1056358REPORT
bugzilla.suse.com/1056678REPORT
bugzilla.suse.com/1057126REPORT
bugzilla.suse.com/1057599REPORT
bugzilla.suse.com/1059201REPORT
bugzilla.suse.com/1059319REPORT
bugzilla.suse.com/1059388REPORT
bugzilla.suse.com/1059524REPORT
bugzilla.suse.com/1059568REPORT
bugzilla.suse.com/1061548REPORT
bugzilla.suse.com/1061574REPORT
bugzilla.suse.com/1061576REPORT
bugzilla.suse.com/1062094REPORT
bugzilla.suse.com/1062476REPORT
bugzilla.suse.com/1063590REPORT
bugzilla.suse.com/1065085REPORT
bugzilla.suse.com/729910REPORT
bugzilla.suse.com/971785REPORT
bugzilla.suse.com/971916REPORT
bugzilla.suse.com/989991REPORT
www.suse.com/security/cve/CVE-2017-7514WEB
access.redhat.com/security/updates/classification/ARTICLE
access.redhat.com/documentation/en-US/Red_Hat_Satellite/5.8/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1458052REPORT
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1558.jsonAdvisory
access.redhat.com/security/cve/CVE-2017-7514REPORT
www.cve.org/CVERecord?id=CVE-2017-7514Advisory
nvd.nist.gov/vuln/detail/CVE-2017-7514Advisory

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities